Explicit hard instances of the shortest vector problem

Explicit hard instances of the shortest vector problem Johannes Buchmann Richard Lindner Markus Rückert

Outline • Motivation • Foundations • Construction • Experiments • Participation

Motivation

Motivation • PQC schemes rely on lattice problems • GGH `96, NTRU `96, Regev `05, GPV `08 • No unified comparison of lattice reduction • Other challenges based on secret • GGH, NTRU

Foundations

Family of lattice classes • Definitions • Lattice: ¤ discrete additive subgroup of Rm

Family of lattice classes • Definitions • Lattice: ¤ discrete additive subgroup of Rm • Class: m = b c1 n ln(n) c, q = b nc2c, For X = (x1,…,xm) 2Zqn£n L(c1, c2, n, X) = { (v1,…,vm)2Zm | i vi xi´ 0 (mod q) } • Class Family: L = { L(c1,c2,n,¢) | c1¸2, c2<c1ln(2), n 2N}

Existence of Short Vector Consider v2 {0,1}m , x1,…,xn2Zqn£n The function v i vi xi (mod q) Has collisions if 2m > qn The lattice L(…,X) 2L contains v2 {-1,0,1}m, so kvk2· m

Hardness of Challenge • Asymptotically: Ajtai,Cai/Nerurkar,Micciancio/Regev,Gentry et al. Finding short vector ) Approx worst-case SVP • Practice: Gama and Nguyen Challenges hard for m ' 500 intractible for m ' 850

Construction

Explicit Bases • Using randomness of ¼ digits Choose X2Zqn£n randomly Set ¤ = L(…,X) 2L • Construction via dual lattice basis B = ( XT | qIm ) spans q¤? • Turn B into basis • Transform B/q into dual basis

Experiments

LLL-type LLL — Shoup fpLLL — Cadé, Stehlé sLLL — Filipović, Koy Run on Opteron 2.6GHz Implementations BKZ-type • BKZ — Shoup • PSR — Ludwig • PD — Filipović, Koy

Performance of LLL-type Algorithms

Performance of BKZ-type Algorithms

Participation

How to Participate • Go to www.LatticeChallenge.org • Download lattice basis Bm , norm bound º • Find v in ¤(Bm) such that kvk < º • Submit v

www.LatticeChallenge.org Successful Participants (chronological order) • Nicolas Gama, Phong Q. Nguyen • Moon Sung Lee • Markus Rückert • Panagiotis Voulgaris

Story • Praticipants found: solutions have many zeros • Strategy to focus on sublattices • Same oberservation as May, Silverman in 2001 working on NTRU • Lead to Hybrid Lattice-Reduction proposed 2007 by Howgrave-Graham

Thank You Questions?

Explicit hard instances of the shortest vector problem